How I Debugged Expensify Bugs & Got Paid

说明与用途

作者修复了 Expensify 移动应用中的两个错误，获得了 500 美元报酬。他重现了问题，分析了网络请求和数据流，找出了根本原因，并提出了已合并到代码库中的修复方案。

问题

Two bugs in Expensify’s React Native app caused user experience issues: an onboarding modal that appeared incorrectly and a chat list that scrolled out of view when navigating with the keyboard.

结果

Both bugs were fixed and merged, earning the author $500 in total. The fixes improved user experience for over 10 million users.

工作流

• Reproduce each bug reliably on a local clone of the Expensify App.
• Inspect the network tab to identify API responses and missing data.
• Trace data flow from API to state store (Onyx) and selectors.
• Identify the root cause in the data layer rather than the UI component.
• Draft a proposal with evidence, including links to relevant code lines.
• Submit the proposal to the GitHub issue for review.
• Implement the fix in the codebase.
• Run tests and verify the bug is resolved.
• Submit a pull request and get it merged.
• Receive payment for the bounty.

证据

Expensify runs one of the most open contributor programs of any production app. Bugs are filed as public GitHub issues, most carry a bounty (typically $250), and anyone can submit a proposal: a written explanation of the root cause and the fix you intend to make.

来源

The network tab told the real story. On app load, the client calls an OpenApp API to fetch initial user data into Onyx, Expensify's client‑side state store. When Xero is connected and 2FA is disabled, the server refuses with error code 666 and returns empty data.

来源

The cause lived in React Native's SectionList virtualization. The shared list component computes getItemLayout offsets by hand, and the list header and footer were accounted for differently than SectionList expects.

来源

My fix (PR #46750, three files) made the initial‑state calculation aware of the pending 2FA gate: if the 2FA requirement modal is about to show, don't treat missing onboarding data as "user needs onboarding". Merged, $250.

来源

My fix (PR #51754) shipped. Merged, $250.

来源